Google searches are redirecting and I have a false anti-virus auto-installed

I've recently gotten a virus which installed a fake anti-virus program called Antimalware Doctor. It automatically started running during a routine scan I do with McAfee (and consequently stalled the McAfee scan). I used alt-F4 to close the program as fast as I could and then immediately started researching it online to see how I could remove it from my computer.

The advice I got seemed to work at first - remove certain files from the registry, close the process and deleting some files from the computer. It seemed to solve the problem of that false program popping up, but I was then getting redirects to my Google searches and randomly popping ads that came up in new tabs.

I started doing more research on that and while I was doing so, Antimalware Doctor popped up again with the same "scanning, your computer may be infected" thing. So now I'm here and looking for help to get rid of the redirects and the false anti-virus.

I started on the eight basic steps to do. I got the temporary files folders cleaned with TFC and then moved onto step 3 - malware bytes. This is where I got stuck. Malwarebytes tells me that it cannot connect to the server when it tries to update. If I'm supposed to update it before running and it can't update, should I just go ahead and run the scan? Or is there another way I can update it.

Due to the above I don't have any logs yet, sadly. I wish I had.

Thanks for any assistance. I'll be very, very happy to have this pesky virus gone from my computer!!!

gmer kept rebooting the computer whenever I tried running it until I did safe mode. Safe mode did the scan but didn't provide a log so I went back to normal mode and opened gmer and a log instantly appeared. Hopefully I did it right...

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Click onthis linkto see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Attached Files:

is that something that will take awhile because I can't be around to computer too much longer tonight

Click to expand...

It depends on your computer state. Normally, it shouldn't take more than 10-15 minutes, but with heavy infection, it may take longer.
Combofix will disconnect you by itself. You dont' have to do anything.

Unfortunately, McAfee is not too smart and it has a history of blocking Combofix (will they ever learn?)
Disable McAfee AV part first (you'll have to to run Combo anyway) and try to download again.
If still no go, let me know...

It asked to install the recovery console and I chose yes. It went through the EULA, etc. blah blah blah, then started running. Well, I figured since it would take 10 to 20 minutes that I'd leave for a few to do something else and come back.

When I came back, Windows had restarted and it said I have three days to activate Windows and that I have to do it because significant changes to hardware were made. Well, since I hadn't read a thing about this and it seemed off I clicked NO. I figured that if that's the wrong choice I can always go back an activate it.

Anyway, I did NOT get any report from ComboFix so I decided to log back online and ask some more questions, but my internet was not connected back yet. Tried a reboot. Nothing (except for the activation notice again). I'm posting this from another computer.

So....the questions:

1. Do I run ComboFix again? Did installing the Recovery Console cause a reboot and that's why I didn't get a report log?

2. Do I activate Windows like it asks me to or is this part of a virus trying to get me to do things I shouldn't?

Thanks once again for your time!

P.S. I may or may not respond tonight as it is getting very late. If I don't I'll definitely be back tomorrow.

I can boot just fine. I just get the message saying I have three days to activate Windows. Internet is not active, however.

Basically I can run everything fine right now EXCEPT internet. The Windows activation message is the only odd thing besides that. It also comes up in the toolbar with a message saying that I have three days as well.

I can't stay online any longer tonight, but I'll be sure to check back in tomorrow. I really appreciate the help!

EDIT: Oh, and as I said, no log from ComboFix. Need to know if I should try running it again or what.

I ran it again and this time I got a log. However, I still do not have internet access with that computer even after a reboot.

I still get the activation notice upon startup. I also cannot turn the Windows firewall back on. I get a message about the Windows firewall settings cannot be displayed because the connection is inactive or some such note. I can't remember it exactly and didn't write it down (duh!).

If I can get access to the internet with that computer I'll post a log. I notice that ComboFix removed some stuff that I had removed previously via regedit (before I came to this site).

*Please disable any AV / ScriptBlockers as they might detect Flash Disinfector to be malicious and block it. Hence, the failure in executing. You can enable them back after the cleaning process*

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.

The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.

Hold down the Shift key when inserting the drive until Windows detects it to keep autorun.inf from executing if it is present.

Wait until it has finished scanning and then exit the program.

Reboot your computer when done.

Note: As part of its routine, Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive that was plugged in when you ran it. Do not delete this folder...it will help protect your drives from future infection by keeping the autorun file from being installed on the root drive and running other malicious files.